SMTP Queue Keeps filling up

Hi,
Ive got a SBS2k Server with all the service packs on it, I have a problem
with our SMTP server.
We use SMTP to send via DNS instead of a smart host, but when I check the
queue it is filled with thousands of messages from
Mailer-Daemon@Zish.Kharkov.ua to which the subject is Virus intercepted.
I'm constantly having to clean this queue throughout the day.
Does anyone know of this as none of these e-mail are being sent out from the
company.
If anyone can help me stop this I would greatly appreciate it.

Thanks in advance

Andy C

Tippy
Wed Apr 28 07:17:01 CDT 2004

You Exchange server may be set up as an open relay. The
thousands of emails may be NDR's to recipeints that dont
exist. Check 324958 HOW TO: Block Open SMTP Relaying and
Clean Up Exchange Server SMTP
http://support.microsoft.com/?id=324958 to test for an
open relay state.

You can disable NDR's in Exchange System Manager >
Internet Message Formats > Right Click Default select
Properties > Advanced tab.

This is my opinion, give it a go.

Tippy.


>-----Original Message-----
>Hi,
>Ive got a SBS2k Server with all the service packs on it,
I have a problem
>with our SMTP server.
>We use SMTP to send via DNS instead of a smart host, but
when I check the
>queue it is filled with thousands of messages from
>Mailer-Daemon@Zish.Kharkov.ua to which the subject is
Virus intercepted.
>I'm constantly having to clean this queue throughout the
day.
>Does anyone know of this as none of these e-mail are
being sent out from the
>company.
>If anyone can help me stop this I would greatly
appreciate it.
>
>Thanks in advance
>
>Andy C
>
>
>.
>

Roddy
Wed Apr 28 07:22:39 CDT 2004

I have this problem too except the emails are being delivered to my inbox. I
think I have some sort of worm on the network. It's going to take a day or
two to sort out.

In the meantime I have set up a sender filter which filters out thse
particular mails. If you open up your SBS main console and use the help, it
will tell you how to activate sender filtering and enter addresses/domains
to block.

Roddy

"Andy C" <andrew.cliffe@codeweavers.net> wrote in message
news:upn4mPRLEHA.1272@tk2msftngp13.phx.gbl...
> Hi,
> Ive got a SBS2k Server with all the service packs on it, I have a problem
> with our SMTP server.
> We use SMTP to send via DNS instead of a smart host, but when I check the
> queue it is filled with thousands of messages from
> Mailer-Daemon@Zish.Kharkov.ua to which the subject is Virus intercepted.
> I'm constantly having to clean this queue throughout the day.
> Does anyone know of this as none of these e-mail are being sent out from
the
> company.
> If anyone can help me stop this I would greatly appreciate it.
>
> Thanks in advance
>
> Andy C
>
>

Andy
Wed Apr 28 07:56:09 CDT 2004

Cheers for you help on this guys, ive checked to make sure im not an open
relay to which im not and ive done a complete sweep with my Anti-Virus
software.
I keep getting these queue's filling up faster than I can clean them.
Any more ideas?

Thanks in advance

Andy C


"Roddy Matheson" <roddy.matheson@greenbeltgroup.co.uk> wrote in message
news:eY1sysRLEHA.3904@TK2MSFTNGP09.phx.gbl...
> I have this problem too except the emails are being delivered to my inbox.
I
> think I have some sort of worm on the network. It's going to take a day or
> two to sort out.
>
> In the meantime I have set up a sender filter which filters out thse
> particular mails. If you open up your SBS main console and use the help,
it
> will tell you how to activate sender filtering and enter addresses/domains
> to block.
>
> Roddy
>
> "Andy C" <andrew.cliffe@codeweavers.net> wrote in message
> news:upn4mPRLEHA.1272@tk2msftngp13.phx.gbl...
> > Hi,
> > Ive got a SBS2k Server with all the service packs on it, I have a
problem
> > with our SMTP server.
> > We use SMTP to send via DNS instead of a smart host, but when I check
the
> > queue it is filled with thousands of messages from
> > Mailer-Daemon@Zish.Kharkov.ua to which the subject is Virus intercepted.
> > I'm constantly having to clean this queue throughout the day.
> > Does anyone know of this as none of these e-mail are being sent out from
> the
> > company.
> > If anyone can help me stop this I would greatly appreciate it.
> >
> > Thanks in advance
> >
> > Andy C
> >
> >
>
>

Leonard
Wed Apr 28 19:00:00 CDT 2004


"Andy C" <andrew.cliffe@codeweavers.net> wrote in message
news:upn4mPRLEHA.1272@tk2msftngp13.phx.gbl...
> Hi,
> Ive got a SBS2k Server with all the service packs on it, I have
a problem
> with our SMTP server.
> We use SMTP to send via DNS instead of a smart host, but when I
check the
> queue it is filled with thousands of messages from
> Mailer-Daemon@Zish.Kharkov.ua to which the subject is Virus
intercepted.
> I'm constantly having to clean this queue throughout the day.
> Does anyone know of this as none of these e-mail are being sent
out from the
> company.
> If anyone can help me stop this I would greatly appreciate it.



Andy,

Welcome to the club.

Look at the headers and you'll see that these do not originate
from Mailer-Daemon... but from 217.41.3.32 which is a DSL account
at btopenworld.com.

Set your SMTP Virtual Server access to deny that IP address
connectivity and you'll be ok.

You can contact btopenworld complaint at
http://www.btopenworld.com/helpnb/contactus/security but don't
hold your breath.

Len Agoado
len@mwswire.com